The analysis will focus on the operational condition of the vehicle, vehicle inspection, passenger safety, safety management, regulatory safety culture, emergency communications, dissemination of safety information and the vehicle's seaworthiness.2.0 Analysis The analysis will focus on the operational condition of the vehicle, vehicle inspection, passenger safety, safety management, regulatory safety culture, emergency communications, dissemination of safety information and the vehicle's seaworthiness. 2.1 Vehicle Operation and Characteristics 2.1.1 Vehicle Pumping System When the driver of the LadyDuck realized that the front of the vehicle was lower than normal, he confirmed that the emergency bilge pumps were discharging water. However, the combined discharge capacity of these two pumps did not stem the increasing ingress of water overflowing the forward visor and the vehicle trimmed progressively by the bow. These were the only operational pumps whose discharges could be observed from the driver's position. The two main bilge pumps were inoperable (seeAppendixA - Bilge Pump Examination and Testing). Small vessels, similar in size to the LadyDuck, are required to carry one manual pump and one bailer. The installation of one manual bilge pump and six power-driven pumps on the LadyDucksignificantly exceeded the normal outfit expected on a vessel of comparable size and service. The pump configuration was in response to TC's concerns regarding the distribution of pumps to cover the lowest areas in the forward and after engine compartments, and the possible lack of watertight integrity of the vehicle. The following concerns were noted in FormsS.I.7 issued by TC: provide means of sealing the forward engine compartment watertight; provide an additional bilge pump in the forward compartment and leave it on automatic; provide an additional bilge pump in the engine compartment located aft; improve the stern door sealing arrangement; and notify TC if abnormal seepage of water was discovered. The front visor was secured in place. However, the bilge pumps were not installed in accordance with manufacturer instructions. Specifically, the wiring connections to the pumps were not watertight or adequately secured, and the main pumps were over-fused. Debris in the impellers stalled the pumps and, as the fuses were too large, induced the failure of the pump motors. Of the six electrically driven bilge pumps, the two that were effectively operable did not stem the ingress of water. The operator of any vessel must maintain an adequate level of awareness respecting the operating condition of the vessel. Water retained within a vessel can cause several adverse operational problems affecting safety. This is particularly true on small vessels where safety margins are limited. In this instance, when the vehicle entered the water, the driver switched on both main bilge pumps, anticipating their discharge from each side of the vehicle. When no water was seen discharging near midships, both emergency pumps were activated and water was seen discharging from both sides of the vehicle. This sequence of events is consistent with the driver's knowledge of the previous location of the discharges from all four pumps, and indicative that he was unaware that the starboard side main bilge pump discharge had been redirected aft and out of his line of sight. Following the vehicle's entry into the water, the starboard side main bilge pump failed. As the vehicle remained afloat approximately 30minutes after leaving the ramp at the Hull Marina, an estimated 345litres of floodwater would have entered the hull due to syphonic action through the discharge piping of the then inactive starboard side main bilge pump. On vessels with a low freeboard, the operator needs to be aware of the existence of water in the bilge and that the bilge pumping system is effectively coping with any ingress of water. Such reliance on the bilge pumping systems can lead to operators not readily recognizing or appreciating the existence or severity of an evolving unsafe condition. Consequently, the operator is deprived of valuable information to make appropriate and timely decisions to successfully identify and resolve the developing situation. Since a bilge high level alarm was not installed and the condition of the bilges could not be observed by the driver, the perception of the emergency situation was delayed due to a lack of information on the amount of water in the bilges. 2.1.2 Passenger Safety Briefings The tour guide had no formal training or written instructions on suitable pre-departure safety briefings. Consequently, only incomplete verbal instructions were given, and passengers were not advised of the location and use of all safety equipment. In addition, passengers did not receive a demonstration on how to correctly don their lifejackets. The size of a lifejacket or a PFD must be appropriate to the body size of the wearer to perform as designed. If the life-saving appliance is too large, too small, or incorrectly worn, the wearer can be at risk of sustaining personal injury and/or drowning. In this occurrence, the PFDs worn by two of the victims were too large for their body size. Although passengers were informed that the rear exit and side windows were emergency exits, no instructions were given about what to do in the event of an abandonment. For example, passengers were not told how to open the windows if they were zipped closed. Passengers were not instructed to look around to determine their nearest exit and they were not cautioned that it may not be the same one used to enter the vehicle. It is recognized within the passenger transportation industry that timely provision of critical safety information helps passengers prepare for potential emergency situations. Such information facilitates the ability of passengers to assume a certain level of responsibility for personal safety, thereby mitigating a portion of risk to which they may be exposed. The Board has made recommendations, based upon the important safety benefit derived from passenger briefings, in its investigations involving the Tan1( TSBreportM93L0004) and the TrueNorthII ( TSBreportM00C0033). On 01May2002, an amendment to the SVR requiring these briefings came into force. However, the outcome of the LadyDuckoccurrence demonstrated that either this requirement may not be known to all operators of small passenger vessels or that the derived safety benefit may not have been fully appreciated. 2.1.3 Emergency Evacuation Training Before the vehicle's rapid sinking, many of the occupants had put on a PFD and lined up at the rear exit to egress. Other than the driver calling for the passengers to abandon the vehicle and the tour guide attempting to throw PFDs/lifejackets to the passengers, there was no direction provided by the crew and they did not facilitate the evacuation toward other exits. The company had no formal evacuation policies, procedures or training that addressed the possibility of a vehicle evacuation. Although the driver had received abandonment instructions during the MEDA1 andA2 course, no specific training or drills were conducted on company vehicles, including the LadyDuck, to put that training into practice. Further, none of the tour guides received hands-on training on the safety equipment, including fire extinguishers, distress equipment and, in the case of the company's larger vehicles, the liferafts. Although the side window exits were larger than the rear exit and available as a means of escape, 11of the occupants initially turned to the rear exit to evacuate. For a few, this may have been due to the driver's earlier request to move to the rear of the vehicle. The others may have been reacting in a manner that has been seen in other evacuations, where people tend to exit through their point of entry. Only two occupants recognized that there was a bottleneck there and chose a side window as their point of egress. Studies on the evacuation of aircraft have shown that passengers tend to look for and expect instructions and guidance from the professional crew.18 In this occurrence, there were no formal company policies or procedures for training tour guides on safety-related issues. Without the benefit of emergency evacuation training, crews on small passenger vessels are left unaware of and unprepared for the dynamics of an emergency and in a position of having to improvise in a situation where there is little or no time to spare. Training the drivers and tour guides on how to facilitate an evacuation on the LadyDuckand emphasis during the safety briefing that the primary evacuation route was through the side windows would have provided the passengers with the appropriate information to avert bottlenecks and likely facilitated an orderly evacuation. 2.1.4 Life-saving Equipment Carriage of the approved lifejackets is required by regulation. The lifejacket, developed for professional mariners, was designed to provide buoyancy and, in the case of injury, keep an unconscious wearer's head face-up above the surface. The PFD, on the other hand, was developed for pleasure craft operators. The premise behind the development of the PFD was that, while it offers reduced performance as compared to a lifejacket, in that it will not keep a wearer's face clear of the water, it will keep users afloat and is more likely to be worn than the higher performance, but cumbersome, lifejacket. The carriage of PFDs on board the LadyDuck was not discouraged during an inspection by TC in May2002 and they remained the first line of defence for water survival. During the evacuation, the passengers who donned PFDs before evacuating were kept afloat until rescued by nearby boaters. While PFDs were not the approved life-saving appliance for the vehicle, it may be that their use on a vehicle such as the LadyDuck,where hull design and the lack of inherent buoyancy can lead to rapid sinking, was more appropriate than the lifejacket. Although they are easier to don and more comfortable to wear, they do not provide all the benefits of an approved lifejacket. A safety deficiency respecting the accessibility of lifejackets has been identified in previous occurrences, including the TrueNorthII(TSB report M00C0033) and of a small open charter boat (TSBreportM92W1031). The Board, concerned about the accessibility of lifejackets for use in an emergency, recommended that TC require that lifejackets be stored in a manner that is readily accessible.19 In this instance, in order for the passengers to retrieve the lifejackets from their storage location below each passenger seat, it would have caused congestion in the narrow centre aisle. During vehicle examination after the occurrence, removing a lifejacket without tearing it on the edges of the metal storage box was a challenge for investigators let alone for passengers who, in a time-critical situation, could have jeopardized the integrity of the lifejacket. Further, other items that were stored on top of the lifejackets presented a challenge to their quick retrieval. This continues to be an issue for small passenger vessels. Standard approved lifejackets were required to comply with CAN/CGSBStandard65-GP-14M, September1978, as referenced in the Life Saving Equipment Regulations.Examination of the lifejackets after the occurrence revealed that some of the children's lifejackets and none of the recovered adult lifejackets met those requirements. Although the lifejackets on the LadyDuckwere 30years old, their carriage would have been permissible as long as each one met the regulatory requirements. A routine inspection process would ensure that substandard equipment would be replaced. However, for such a process to be effective, it would have to be conducted on a regular basis. Random inspections would not accomplish the most timely elimination of substandard equipment. Two non-standard decorative lifebuoys were permanently attached to the exterior of the vehicle. These items were not part of the life-saving equipment, although they were approximately the same size and looked like the approved 610mm-diameter lifebuoy. The use of such items or any safety equipment as decoration is misleading from a safety perspective. 2.1.5 Emergency Signage Passengers' knowledge of critical safety information, gained through safety briefings, may be reinforced by posting emergency signage and safety information; neither was provided on the LadyDuck.The availability of safety information and reference to its existence during safety briefings would better prepare passengers for potential emergency situations. Signage on the side windows would have emphasized their availability as an emergency exit. 2.1.6 Suitability of Rear Exit as a Primary Exit for Egress Before the water-borne portion of the tour, passengers were briefed that the window openings along the sides and at the rear of the vehicle were to be used as exits in the event of an abandonment. Conventional human engineering standards would therefore dictate that any opening identified as an emergency exit should be large enough to accommodate 95thpercentile values of body dimensions wearing an approved lifejacket. While the side windows were of a size and location that allowed unobstructed egress with a lifejacket donned, the width of the rear exit did not meet conventional standards. Use of the rear exit was further impeded by the fact that the boarding ramp could not be lowered once the vehicle was in the water, to protect the watertight integrity of the vessel, and its stowage reduced the opening available. During the evacuation of the LadyDuck,the rear exit was not easily accessed and its size presented a challenge for egress. Given these limitations, the side windows should be considered the primary exits in the event of an abandonment. 2.1.7 Transparent Roll-down Side Screens On the occurrence tour, two transparent roll-down side weather screens were zipped closed. Although no one attempted to use these exits, the availability of any closed window as an exit was questionable due to the inaccessibility of the zipper slides. Nevertheless, the closing arrangement was such that it would have been difficult to open the windows had they been zipped closed. 2.1.8 Fabric Awning Design Hazards associated with continuous canopies in vessels without inherent reserve buoyancy, like the LadyDuck, have been documented by the NTSB (seeAppendixD). In the investigation of the sinking of an amphibious passenger vehicle, the MissMajestic, the NTSB concluded that, ...the canopy on the MissMajesticwas a major impediment to the survival of the passengers. The NTSB recommended that, until such vehicles are provided with sufficient reserve buoyancy to remain upright and afloat in a fully flooded condition, the canopies (awnings) should be removed for water-borne operations or a Coast Guard-approved awning should be installed ...that does not restrict either horizontal or vertical escape by passengers in the event of sinking (M-02-2). Further, the NTSB recommended that ...where canopies have been removed on amphibious passenger vehicles for which there is not adequate reserve buoyancy, require that all passengers don lifejackets before the onset of waterborne operations (M-02-3). The LadyDucksank so rapidly that some of the passengers were unable to egress before the vehicle was underwater and they drowned. As the vehicle sank, the natural buoyancy of the victims, some of whom had donned PFDs, forced them into the overhead awning, preventing vertical escape. An awning designed to be easily removed before entering the water, combined with a requirement for passengers to wear lifejackets, would have mitigated the consequences. 2.1.9 Vehicle Licensing/Certification Amphibious vehicles are not subject to licensing under the SVR. Therefore, an amphibious vehicle with a gross tonnage of less than15 is not entered in the data banks of either the DFO for pleasure craft or TC for small commercial vessels. Truck and bus operators operating within Ontario are required to register as commercial vehicle operators (CVOs) by the MTO. It is an offence to operate a commercial motor vehicle without being registered. CVO registration creates a Commercial Vehicle Operator Record that, once set up, allows the collection of licensing and compliance data (accidents, convictions, inspections). Amphibious vehicles operate in a dual mode (land-water) and are subject to two regulatory authorities (provincial-federal). Because of a lack of marine experience, owners of amphibious vehicles may operate without being aware of the applicable marine requirements. Currently, there is no regime in place to ensure that TC is made aware of an amphibious vehicle being placed into service. If the applicant for a provincial vehicle licence was instructed by the licensing authority to contact TC regarding marine requirements, this would help mitigate the risks. 2.1.10 Vehicle Operational Condition and Characteristics After the accident, the vehicle was the subject of structural, mechanical, pumping and other safety-related equipment inspections and tests. A series of speed, freeboard, trim, wave-making, and flooding trials was also completed to determine the operational characteristics and physical condition of the LadyDuck.Review and analysis of these inspections, tests and trials showed that the safe operation of the vehicle was at risk due to the following: The condition of the vehicle meant that watertight integrity could not be maintained. Watertight integrity was compromised by fractures, the absence of effective watertight glands and seals, and water syphoning action through bilge piping. When operating in calm water conditions, the LadyDuckwas vulnerable to shipping water over the bow, because of low initial static forward freeboard and of proportional loss of effective forward freeboard due to the bow wave created by the speed of the vehicle. When operating in water disturbed by the wakes of other craft, the LadyDuckwas highly vulnerable to shipping water when relatively moderate waves were encountered. The effective static forward freeboard in the loaded condition, when reduced by the progressive accumulation of floodwater in the hull, was insufficient to prevent the entry of water from bow waves generated at service speed. The non-watertight construction of the hood and the installation of 75mm-diameter (3-inch) cowl ventilators at its forward end, after the completion of TC's inspection, allowed the ingress of water when the forward freeboard was reduced and waves were encountered. The design and construction of the vehicle were such that all bilge and floodwater initially accumulated in the forward half of the hull caused a forward trimming moment and a reduction of effective forward freeboard. This reduction of forward freeboard made the vehicle more vulnerable to shipping water at speeds lower than when completely free of floodwater. Launching trials at the Hull Marina showed that, when the visor was submerged before the front of the vehicle became fully buoyant, water was shipped and accumulated in a well specifically served by the forward bilge pump. Malfunction of this pump would result in floodwater being retained on board, causing a reduction of the effective forward freeboard at the start of each water-borne tour. In the event of pump malfunction or failure, any accumulation, including floodwater due to hull leakage, could not be detected by the driver. The combined weight of the shipped water and floodwater from drive shaft bearing leakage and bilge piping syphon effects would reduce the forward freeboard. This would render the vehicle more vulnerable to shipping water over the visor as speed was increased and its own bow wave and the wakes of other vessels were encountered. In summary, limiting the speed of the vehicle, having adequate freeboard, maintaining watertight integrity and having fully operational bilge pumps with alarms would have, to a large extent, mitigated the risks presented by the non-conventional design of this vehicle. 2.2 Managing Safety Effective safety management requires all organizations, large or small, to be cognizant of the risks involved in their operation, competent to manage those risks, and committed to operating safely. However, there is no regulatory requirement for operators of small passenger vessels to have a safety management system. The picture that emerged from this investigation was one of an organization pursuing minimal compliance with regulations rather than one seeking to minimize risk through all available means. 2.2.1 Cognizance of Risks Presented in the Operation of the LadyDuck The LadyDuckwas designed and built by its operator to conduct amphibious tours. Characteristics of the vehicle indicated a lack of awareness of marine standards of construction and maintenance, in that the vehicle was constructed with low freeboard, without watertight fittings at through-hull penetrations and with incorrectly installed bilge pumping arrangements. This created the potential for a regular ingress of water, a risk that was, to some degree, mitigated by fitted drainage systems and additional bilge pumps. 2.2.2 Competence to Manage Risks Generally, organizations have two ways to manage risks effectively. For novel or non-routine tasks, the organization may rely on a high level of expertise and training to ensure that tasks are completed safely. For routine operations, procedures may be provided to prescribe how tasks will be carried out. This occurrence revealed many aspects of the company's operations where procedures remained undocumented and informal, including the following: Minimum knowledge requirements for drivers and guides were not defined and the training process for these positions was not documented. Vehicle deficiencies were reported by drivers in a written log for maintenance action, but subsequent drivers did not review this log as a matter of routine. No guidance was provided to drivers in terms of minimum vehicle equipment serviceability; it was left to the driver to judge whether the vehicle was fit to operate. Despite the potential for the low freeboard of the vehicle to be overcome by a bow wave at certain speeds, there were no physical or administrative defences in place to prevent the vehicle from being operated at these speeds. There was no procedure or contingency plan outlined to the driver or the guide on how to conduct emergency communications or to respond to emergency situations and, in the extreme, to effect a timely evacuation of the vehicle. This lack of formalized procedures placed the onus on drivers to make decisions with respect to the safe operation of the vehicle. This occurrence also revealed that the training provided by the company to enable drivers to make such decisions was minimal and informal. It was reported that the occurrence driver had received 12 hours of company training to operate the amphibious vehicle. To provide an understanding of the vehicle systems (including bilge pumping), the driver was shown around the vehicle by the company mechanic. No company records were available to verify the amount of training provided, or the competency level achieved, in terms of understanding the vehicle and its systems. Faced with a situation in which neither of the two bilge pumps were seen to be discharging, the driver had neither the training to properly assess the risk associated with that deficiency nor a formal procedure to provide guidance on a specific course of action. This created a situation where, in verbal communication, the driver deferred to the judgement of the mechanic who, in turn, believed that it was the decision of the driver whether the vehicle should continue in service. Thus, the organization operating the LadyDuckdemonstrated neither a sufficient cognizance of the risks associated with operating the vehicle in the marine environment nor the competence to manage those risks effectively. 2.2.3 Commitment to Safe Operation The organization did not demonstrate a commitment to operating safely in that it did not seek the advice of TC with respect to the condition of the vessel and was reticent to follow recommendations that were not specifically required by regulation, in the following ways: Reportedly, the owner/builder did not notify TC of the start of construction of the vehicle, and there is no documentation of a formal request for inspection while it was being constructed. Following the occurrence of 30June2001, the owner questioned TC regarding the need to implement the corrective measures set out by the inspector on Form S.I.7, and although the owner took action to address items required by regulations, not all the items assessed as recommendations were addressed. TC was not informed of modifications made to the vehicle (addition of air ventilation cowls in the hood and modifications to bilge pumping arrangements) that had the potential to have an impact on its watertight integrity. Although bilge high level alarms were installed in some of the company's amphibious vehicles, this safety device was not fitted to the LadyDuckbecause, being a smaller vessel, it was not required by regulation. TSB statistics demonstrate that there is a disproportionate number of fatalities in accidents involving smaller vessels.20 There are particular risks associated with small passenger vessel operation that arise from operating conditions or vessel characteristics. An effective safety management system is key in any organization to ensure that individuals at all levels have the knowledge and the tools to effectively manage risk. Currently, there is no requirement for overview or guidance from the regulator to operators of small passenger vessels with respect to safety management. 2.3 Regulation of Small Passenger Vessels and Safety There is a public expectation that a commercial enterprise is sufficiently regulated to provide a satisfactory level of safety. Members of the travelling public likely do not differentiate between large and small passenger vessels in terms of the degree of risk. Most believe that action has been taken to ensure that the vessel, regardless of its size and area of operation, is properly maintained, the crew is competent, the vessel will be operated in a safe manner and that contingency plans are in place should an emergency arise. To this end, TC's marine safety mandate encompasses responsibilities relating to promoting the safety of vessels and environmental protection. There are, however, distinct challenges associated with achieving this mandate with respect to regulating small passenger vessels, due to: limited resources; the large number of small passenger vessels in operation; the inability of regulations to cover every eventuality or novel aspect of construction and operation of a wide range of small commercial vessels; the diverse and geographically dispersed population of operators; the limited nautical knowledge and experience of some operators and owners; and the reluctance of some owners to implement recommendations that exceed the regulatory requirements. 2.3.1 Complexity and Adequacy of Safety Requirements Given the distinct challenges associated with promoting small passenger vessel safety, the regulatory framework must be clear, easy to apply and provide an adequate level of safety regardless of vessel size and configuration. Current marine requirements contained within the CSA, its regulations, standards, and guidelines are complex and, as such, it is difficult for owners, operators, and TC inspectors to determine which requirements apply to a particular class of vessel. This has been acknowledged by TC and is reflected in the training given to inspectors with respect to small commercial vessel inspections. This complexity was demonstrated in this occurrence with respect to the first inspection requirement of the LadyDuck.At the time of the first occurrence, TC determined that this vehicle, with a gross tonnage of less than5, did not require a first inspection. Nevertheless, following a review of the regulatory framework, it was later given a first inspection. This complexity of the regulations is reflected in the following: Under subsection316(3) of the CSA, every Canadian vessel shall have its hull, machinery, and equipment inspected before it is first put into service. Under section406, vessels such as the LadyDuck are exempt from an annual inspection. According to the CSA, inspections are to be conducted in accordance with regulations. The Hull Inspection Regulationsare not applicable to vessels with a gross tonnage of5 or less. This led to the interpretation that the LadyDuck did not require a first inspection. Following the2001 occurrence, the vehicle had a first inspection under the auspices of the SVMIP. Although this is an interim program that does not have the force of regulation, it provides for a mandatory first inspection as required by the CSA. In conducting a first inspection, the inspector must determine what regulations apply, since the CSA requires that inspections be conducted in accordance with regulations. Table A of the SVMIP21 provides some guidance in this regard through a small passenger vessel safety requirements matrix. For vessels such as the LadyDuck, the matrix indicates that the requirements are the CSA, the guidelines in AppendixB until TP1332 is revised, and the SVR. Therefore, an inspector examining the requirements will find that the CSA provides for a first inspection, and Appendix B contains interim guidelines (that are not enforceable), thus leaving the SVR as the only requirement that can be enforced during inspection. The regulatory framework that applied to the LadyDuck did not adequately address the risk involved in the vehicle's operation. Although the LadyDuck, with a gross tonnage of less than5 and carrying not more than 12passengers, had a first inspection, it was not subject to construction requirements, did not require a qualified operator, and the company was not required to have a safety management structure in place. In contrast, when more than 12passengers are carried, vessels are subject to additional requirements that address the hull, machinery, electrical systems, fire protection equipment, life-saving equipment, and stability, thus affording a greater level of passenger safety. As a consequence, the effectiveness of the regulatory framework is compromised in that the complexity of regulations, standards, and programs that apply to small passenger vessels may not be readily understood by the owners, operators, and inspectors who must apply them. Furthermore, the current regulatory framework does not address all aspects of small passenger vessel operations. Consequently, vessels that may not be fully fit for their intended purpose may operate, placing passengers at risk. 2.3.2 Promoting Safety versus Ensuring Compliance Following the sinking of the small passenger vessel TrueNorthII(TSBreportM00C0033), the Board indicated that, for the TC ship inspection regime to achieve its safety objectives, systemic deficiencies needed to be addressed in a broader context. The Board, concerned that a rule-book approach can produce too narrow a focus where safety inspectors do not address safety deficiencies not covered by regulations, recommended that: This recommendation encourages a culture in which inspectors are empowered to look beyond the regulations and address any safety deficiency. In response to that recommendation, TC stated that it This indicates a desire, on the part of TC, to move in the direction of promoting safety in addition to ensuring compliance. However, from the LadyDuckinvestigation, it was apparent that service delivery and organization practices had not yet been brought in line with this intention. The difference between the desired objective described by TC and the practices observed in this occurrence is an indicator of the difficulties involved in achieving change within an organization whose day-to-day operations are founded upon ensuring compliance through the force of regulation. During the first inspection(2001), the inspectors applied the safety requirements of the SVMIP, which were intended to supplement the regulatory framework for small passenger vessels. Regional management, faced with a request for clarification from the owner, and the knowledge that the safety requirements of the SVMIP could not be enforced, changed some of these requirements to recommendations and communicated them to the owner as recommendation only by the attending inspector. In this instance, the rule-book approach rendered management incapable of supporting safety requirements that did not carry the force of regulations. As a result, at the subsequent random inspection in spring2002, the inspector opted to refer to applicable regulations, to the exclusion of the SVMIP or other assessment criteria. TC continues its efforts to instill an approach to safety where the front-line inspectors are able to apply their marine expertise when determining the suitability of a vessel, its crew, and the owner's ability to safely operate the vessel. These inspectors require the tools to initiate appropriate action where it can be verified that an unsafe situation exists. Further, that approach also shows that vessel owners and operators must consider and implement inspection recommendations pertaining to the safe operation of their vessel or propose acceptable alternatives. Promoting safety in addition to ensuring compliance will require a long-term effort at all levels within the marine community. The use of a rule-book approach continues to undermine TC's efforts to create a culture within the marine community where inspectors, owners, and operators look beyond regulations and manage risks. This leads to a situation where safety deficiencies may go unidentified, placing passengers at risk. 2.3.3 Seaworthiness The condition defining the overall safety and soundness of all vessels and small craft is often expressed by the term seaworthy. Although the term is generally accepted, attainment of this condition is dependent on the particular circumstances under consideration. The current CanadaShippingAct(1985) and the latest revised version CanadaShipping Act(2001) include, but do not specifically define seaworthy. However, all accepted definitions of seaworthiness refer to the sufficiency of a vessel for its intended voyage. For example: Seaworthy - This adjective, applied to a vessel, signifies that she is properly constructed, prepared, manned, equipped, and provided, for the voyage intended. A seaworthy vessel must, in general, be sufficiently strong and staunch and equipped with appropriate appurtenances to allow it to safely engage in the trade for which it was intended. Seaworthiness - The sufficiency of a vessel in materials, construction, equipment, crew, and outfit for the trade or service in which it is employed. Seaworthiness - The sufficiency of a vessel in materials, construction, equipment, crew, and outfit for the trade or service in which it is employed. The TSB trials revealed safety shortcomings, calling into question the seaworthiness of the LadyDuck.These shortcomings included the following: lack of watertight integrity; defective pumps; low freeboard in conjunction with the operational environment; less-than-adequate equipment and its condition; and inability of personnel to effectively deal with emergencies. In order to ensure seaworthiness, a person or an organisation who has an impact on the operation of the vessel must determine the risk associated with the intended voyage or service, and how the construction, preparation, crew selection, and the equipment mitigate that risk. The persons or organisations whose actions establish whether a vessel is seaworthy are the owner, operator and the regulator. Conversely, failure of the owner, operator and the regulator to take an appropriate action may result in a vessel's seaworthiness being insufficient. 2.4 Emergency Communications Part of the CCG's MCTS mission is to provide communications and traffic services for the marine community to ensure the safety of life at sea in response to international agreements.22 The issue of communications and of MCTS antenna coverage on the Ottawa River was discussed in TSB reports on an occurrence involving the passenger vessel MissGatineau (TSBreportM00L0043) and the previous LadyDuckoccurrence (TSBreportM01C0033). There are currently at least 21commercial passenger vessels and numerous pleasure craft operating on the Ottawa River between Carillon, Quebec, and Ottawa, Ontario. Notwithstanding this, CCG's MCTS do not provide marine VHF coverage in the Ottawa area. Vessels operating outside VHF coverage and not more than five miles from shore are not required to carry a VHF radiotelephone. As a result, vessels operating on the Ottawa River between Carillon and the Ottawa area cannot access SAR resources (including local municipal fire and police departments) through the established MCTS communications system using VHF radiotelephone. Consequently, operators who use VHF radio as their initial means of communicating a distress situation are at risk, in that they rely solely on two CCG auxiliary craft or other private or commercial craft in the area who may or may not be monitoring VHF channel 16. The fire departments of Ottawa and Gatineau are equipped for marine emergency response duties when alerted through a 911 emergency response system. Proposed amendments to the Ship Station (Radio) Regulations, 1999, which prescribe the radio equipment to be carried by commercial vessels, were published in the CanadaGazette, PartI, on 12April2003, vol.137, No.15. All passenger vessels, engaged on a voyage outside a VHF coverage area, are required to be equipped with radio equipment capable of establishing continuous two-way communications with an MCTS centre or a person ashore. It is anticipated that the proposed amendment will come into force in2004. In this occurrence, bystanders with cellular telephones called911. Because the company had no formal standard operating procedures and emergency preparedness plan, and the driver had not been trained for such contingencies, the driver's radio distress call was made on emergency VHF channel16. Since the Hull Marina monitors channel68, this call was probably not received by any traffic service organization, although it may have been received by private vessels monitoring VHF channel16. In summary, vessels issuing distress calls in this area are not able to contact MCTS on the appropriate distress channel and must rely on 911emergency services and on local vessels that may be monitoring the emergency frequency. The lack of effective monitoring and formal emergency communication constitutes a degree of risk to the persons aboard a vessel in distress. 2.5 Dissemination of Safety Information In the past, safety information (that is, SSBs) was disseminated to stakeholders by way of an established mailing list. However, in recent years, SSBs have also been posted on the Internet.23 While anyone may request inclusion on this mailing list, not everyone who operates a small vessel is aware of its existence. A review of the SSB mailing list maintained by TC revealed that a substantially large number of small vessel operators, including the owner of the LadyDuck, are not on the list. In response to TSB Marine Safety Advisory 07/01 (TSBreportM01L0100), addressed to TC, TC has recognized that the current method of disseminating safety information is not always effective. Consequently, an evaluation of the system is underway to determine the most effective method of communicating relevant safety information to specific audiences best suited to enhance safety. 3.0 Conclusions 3.1 Findings as to Causes and Contributing Factors The condition of the vehicle was such that watertight integrity could not be maintained, and there was continuous entry of water into the hull. The non-watertight construction of the vehicle hood, the installation of 75mm-diameter (3-inch) cowl ventilators at the hood's forward end, and the low forward freeboard in the loaded condition allowed the ingress of water from bow waves generated at service speed. The lack of information on the amount of water in the bilges, associated with the absence of a bilge high level alarm and the position of a discharge out of sight of the operator, deprived the operator of information essential to declare an emergency in a timely manner. The company installation of the bilge pumps was not in accordance with manufacturer instructions. Of the six electrically driven bilge pumps installed, the two that were effectively operable did not stem the ingress of water. The company did not have an effective safety management structure/system in that the procedures concerning the operation of the LadyDuck were informal and undocumented. The regulatory framework that applied to the LadyDuckdid not adequately address the risk involved in the vehicle's operation, in that the LadyDuck was not subject to construction requirements, did not require a qualified operator, and the company was not required to have a safety management structure in place. The rear exit did not meet human engineering standards to permit easy egress for a full range of users. The natural buoyancy of the victims, some of whom had donned personal flotation devices (PFDs), forced them into the overhead awning, preventing their vertical escape. 3.2 Findings as to Risks Safety briefings did not mention the availability and location of the lifejackets. A demonstration on how to don either a lifejacket or a PFD was not given and there was no signage indicating the location of the lifejackets. The complexity of regulations, standards and programs that apply to small passenger vessels is such that they may not be readily understood by inspectors, owners, and operators who must apply them. This complexity reduces the effectiveness of the regulatory framework to help ensure safety. The current regulatory framework does not address all aspects of small passenger vessel operations. Consequently, vessels that may not be fit for their intended purpose may be operating, placing passengers at risk. The use of a rule-book approach by Transport Canada (TC) continues to undermine its efforts to create a culture within the marine community where inspectors, owners and operators look beyond regulations and manage risks. This leads to a situation where safety deficiencies may go unidentified, placing passengers and crew at risk. None of the exits was marked as an emergency exit. No guidance was provided, either by signage or during the safety briefing, as to their means of opening. When the roll-down transparent weather screens on each side of the vehicle were zipped closed, the zipper slides that were used to secure the weather screens were neither visible nor easily reachable from inside the vehicle. Such arrangements compromise the safety of passengers. Stowage lockers under the passenger seats did not allow for easy retrieval of the lifejackets. Lifejackets that are not readily accessible preclude their use in emergency situations, thereby compromising the safety of passengers and crew. The lack of hands-on training leaves tour guides ill-prepared to use safety equipment effectively in emergency situations. Marine Communications and Traffic Services do not provide marine very high frequency VHF coverage in the Ottawa area. Search and Rescue response is limited to two Canadian Coast Guard auxiliary craft or other private or commercial craft in the area. These craft monitor emergency VHF channel16 intermittently. 3.3 Other Findings The PFDs worn by two of the victims were too large for their body size. Some of the children's lifejackets and none of the recovered adult lifejackets met the requirements of CAN/CGSBStandard65-GP-14M, September1978. The lifebuoy carried on board did not meet applicable standards for this vehicle and was so secured to its support that it could not be immediately deployed. The use of non-standard lifebuoys or any safety equipment as decoration is misleading from a safety perspective. The current method of disseminating safety information through ship safety bulletins is ineffective since a large number of small vessel operators, including the owner of LadyDuck, are not aware of these bulletins. TSB tests showed that the strength of the seat anchorages of the LadyDuck was lower than TC's Motor Vehicle Safety Regulations requirement. Highway carrier inspection of the vehicle conducted by the Ministry of Transportation of Ontario (MTO) revealed deficiencies that had a significant impact on the safety of the vehicle on the road. The lack of coordination between TC and the MTO permits owners of MTO-registered amphibious vehicles to operate without being aware of the applicable marine requirements and TC may not be informed of a new commercial amphibious vehicle being put in service. 4.0 Safety Action 4.1 Action Taken 4.1.1 Pre-departure Safety Briefings In July 2002, the Transportation Safety Board of Canada (TSB) sent Marine Safety Advisory (MSA) 07/02 to Transport Canada (TC) indicating that steps should be taken to ensure that operators of passenger vessels conduct required safety briefings before departure and that the content and delivery of those briefings are in keeping with the intent of the regulation. In response, TC has indicated that the following action, among others, was taken to date: On 11 July 2002, a letter was issued to Ontario operators and one manufacturer of amphibious passenger vehicles, informing them of the regulatory requirement for passenger safety briefings. Similar letters were issued to operators of amphibious passenger vehicles throughout the country. The same information, including reference to passenger safety briefings, was sent out as an advisory note to TC marine inspectors. On 27 July 2002, TC issued Ship Safety Bulletin (SSB)06/2002 to advise operators of the regulatory amendment requiring safety briefings on all passenger vessels, and the importance of these briefings. TC has added the above SSB and a discussion of safety briefings as a teaching point in the Small Passenger Vessel Inspection Course for marine inspectors. TC further advises that efforts are being undertaken to educate the general public to expect and request a safety briefing before departure. These communication efforts include, as of 03July2003, three different public service announcements broadcast on Mto Mdia and the Weather Network and posters in tourist areas. 4.1.2 Bilge Pumping System In August 2002, the TSB sent MSA 08/02 to TC, indicating shortcomings with the operation of the bilge pumping system. In response, TC has indicated that the following actions were taken: Immediately after the accident, all amphibious passenger vehicles were inspected, including bilge pumping and alarm systems. On 11 July 2002, a letter was issued to Ontario operators and one manufacturer of amphibious vehicles, informing them of precautionary measures and best practices concerning bilge pumping systems. The same information was sent as an advisory note to TC marine inspectors. On 23 August2002, TC issued SSB09/2002, highlighting the importance of bilge pumping and alarm systems on small vessels. 4.1.3 Lifebuoy Requirements On 23 December 2002, the TSB sent Marine Safety Information Letter (MSI) 12/02 to TC, indicating that the lifebuoy fitted on the vehicle was 610mm in diameter rather than an approved 762mm lifebuoy, as required by Small Vessel Regulations (SVR). Further, examination of the 610mm lifebuoy revealed that, although it was stamped with TC's approval number TC.143.014.045, it did not meet applicable standards as set out in both TP7325, Standards for Lifebuoys and Integral Equipment,and section8, Schedule III of the SVR. The lifebuoy grab lines were of varying lengths (570,590,600,and 610mm), rather than the required length of not less than 610mm for each line. In addition, the lifebuoy was attached to the top of the after bulkhead of the vehicle by way of a bungy cord, the hooks of which were clasped together behind the lifebuoy and out of sight. Because of the mode of attachment, it was not available for immediate deployment. In response, TC agreed that the lifebuoy should have been 762mm in diameter and it appears that the manufacturer did not produce the lifebuoy according to the approved prototype. TC met with the manufacturer and reviewed its quality assurance and inspection procedures. An audit of four lifebuoys revealed that grab lines met the lifebuoy standard. A follow-up inspection by TC was planned for spring of2004. 4.1.4 Small Vessel Regulations On 10 January 2003, the TSB sent MSI01/03 to TC, advising that a summary review of the SVR revealed inconsistencies that could be confusing to operators who must abide by the regulations and to inspectors who must enforce them. TC indicated that, as a result of ongoing initiatives, amendments to the SVR were published in CanadaGazette, Part I, in December2003, which will, inter alia: incorporate TP1332, Construction Standards for Small Vessels,by reference, establishing minimum mandatory standards. TP1332 has also been reformatted to make it easier to read; establish life-saving equipment carriage requirements for vessels with a gross tonnage of 0to15; address inconsistencies regarding lifejackets; introduce stability requirements for new vessels. The amendments incorporating TP1332, expected to come into force in2004, will require new small vessels to comply with that construction standard. Existing small vessels, including small passenger vessels, will be required to comply with the standard insofar as it is reasonable and practicable to do so. Inconsistencies regarding lifebuoys will be addressed in phase II of the Regulatory Reform, scheduled to commence in2005 or earlier. 4.1.5 Lifejackets At the November2002 Canadian Marine Advisory Council (CMAC) meeting, TC advised that regulatory amendments being planned include requirements that all passenger vessels carry enough lifejackets suitable for children and that all lifejackets be stored, readily accessible, in clearly marked locations. The Life Saving Equipment Regulationswere subsequently amended on 24February2004. However, the Life Saving Equipment Regulationsdo not apply to vessels with a gross tonnage of5 or less that are certified to carry not more than 12passengers. It is anticipated that those vessels will be covered by similar amendments being proposed for the SVR. 4.1.6 Small Commercial Vessel Safety At the CMAC meeting in November2002, the Small Vessel Working Group proposed, inter alia,that TC prepare a comprehensive outline on implementing International Organization for Standardization (ISO) stability and buoyancy assessment on new and existing vessels of between 6m and 12m in length and carrying not more than 12passengers. A study has been initiated to examine amphibious vehicle safety and the following issues will be addressed: hull integrity, bilge pumps, escapes, seating, intact and damaged stability, operation, and personnel. The study is intended to assist TC in making decisions respecting such vehicles. The Small Commercial Vessel Safety Guide (TP14070),which is intended to provide owners and operators with an overview of the safe operating practices, certification, construction, and safety requirements, has just been completed and published. Furthermore, TC has adopted a policy for assessing stability of existing vessels. Owners may choose to have their vessel assessed to one of three standards developed by the United States, the United Kingdom or the ISO. Additionally, there will be a fourth option for assessing stability, a TC-simplified stability requirement based on ISO. For vessels that do not go beyond 20nautical miles from shore, owners may select one of the three standards or opt to assess their vessel to a set of simplified requirements. A notice to advise owners and operators of this policy is being prepared for public information for release by the end of May2004. Presentations, explaining the policy and the procedure for assessing vessels against the simplified requirements, have been held in all TC regions. In 2003, TC introduced the Small Vessels' Operator Proficiency Course to address, inter alia,minimum training for operators of small passenger vessels with a gross tonnage of less than5. The goals of this non-mandatory course include: providing participants with a basic understanding of the hazards associated with their vessel and prevention of shipboard incidents; knowledge to deal with emergencies; and knowledge and skills to safely operate a vessel in sheltered waters. To obtain certification upon the successful completion of the course, participants must have met the qualifying sea service and successfully completed the Small Vessel Basic Safety Training (Marine Emergency DutiesA3) and Marine First Aid, Basic Certificate or equivalent. Consideration of making the proficiency course mandatory will be addressed by TC in a discussion paper under the Marine Personnel Regulations. 4.1.7 Requirements for Radio Communication Amendments to the Ship Station (Radio) Regulations, 1999, published in the CanadaGazette, PartI, on 12April2003,will require vessels of more than 8m in length, of closed construction, to carry a very high frequency (VHF) digital selective calling radiotelephone on all home trade voyages, except for home trade voyages classIV that are within a Vessel Traffic Services (VTS) coverage area. This does not apply to vessels on inland or minor waters voyages. While these amendments do not apply to vehicles such as the LadyDuck,an additional amendment to the regulations is being prepared that will require all passenger vessels that are not currently required to fit a VHF radio, regardless of area of operation, to have a reliable means of two-way communication. When the amendment comes into force, vessels operating in VHF coverage areas will require a VHF radiotelephone and vessels operating in areas where VHF coverage is not provided will require some other means of communicating with a responsible party ashore. In terms of inspection, the operator or master will be required to demonstrate the operational readiness of the selected means of two-way communication. 4.1.8 Small Vessel Inspection System A database for recording vessel particulars and details of inspections has been developed by TC. A study recommending a framework for evaluating small vessel risk factors has been completed. The findings of the study will be combined with the data collected by the Small Vessel Inspection System to develop risk indices of vessels to aid in selecting vessels for random and targeted compliance monitoring inspections. 4.2 Action Required To ensure a vessel is seaworthy, i.e. fit for its intended purpose, the specific risks of an operation must be well understood and measures must be put in place to mitigate these risks. This applies not only to the construction of the hull, its machinery, and equipment, but also to crew competency and operation. To that end, the owner/operator must continuously identify and address the risks that may be encountered in day-to-day operations. Risk-mitigating options must be considered and defences, which may be administrative and/or physical, put into place to reduce or eliminate the probability or consequences of an unwanted event. To mitigate common risks, the regulator must provide a framework that is easily understood and applied by small passenger vessel owners/operators. In addition, to address risks specific to an operation, the regulator needs to take steps to ensure owners/operators have mechanisms in place to identify and mitigate risks on an ongoing basis. 4.2.1 Management of Safety by Operators of Small Passenger Vessels Between 1975 and 2002, there were 166shipping accidents involving small passenger vessels resulting in 57fatalities. In contrast, during the same period, there were 5fatalities that resulted from 1083shipping accidents involving all other passenger vessels. Thus, passengers involved in an accident aboard a small passenger vessel are more likely to suffer serious consequences. Therefore, the hazards associated with the operation of small passenger vessels must be identified and addressed to prevent accidents and reduce the impact of accidents that may occur. The effective management of safety requires operators to be able to identify the hazards associated with their operation, assess the risk arising from those hazards, and identify mitigation strategies to reduce the risks to the lowest possible level. However, as demonstrated in this occurrence, small passenger vessel operators may not be aware of the risks associated with the operation of their vessels or possess the competence to manage those risks. A safety management system (SMS) represents a systematic, explicit and comprehensive process for the management of safety risks24 and is being widely embraced as the mechanism through which knowledgeable owners/operators can effectively identify and mitigate risks. An SMS in the marine environment will include, among other elements: procedures and instructions to ensure the safe management and operation of vessels; defined levels of authority and clear lines of communication between and amongst the management ashore and the management on board each vessel; procedures for the maintenance of vessels; procedures for reporting accidents, incidents, and hazardous situations; procedures for preparing for and for responding to emergency situations; and analysis and documentation of lessons learned. The Board notes that TC's Small Commercial Vessel Safety Guide (TP14070)encompasses some of the principles underlying an effective SMS. However, it does not go so far as to provide the means or structure through which such principles can be achieved. As demonstrated in this occurrence, the absence of a formal structure for vehicle maintenance and emergency response has the potential to adversely affect passenger safety. Although regulations are coming into effect in other modes to make SMS a requirement for most operators, the International Safety Management Code for the Safe Operation of Ships and for Pollution Prevention (ISM Code),which specifies the requirements in terms of safety management within the marine mode, is only required for certain convention ships. This includes passenger ships and cargo ships with a gross tonnage in excess of500. However, ships that remain within Canadian waters are not considered convention ships. As such, although the code is voluntarily applied by many larger passenger vessel operators, there is no regulatory requirement for the operators of small passenger vessels to have an SMS. At the request of TC, a study to evaluate the feasibility of implementing an SMS for the Canadian domestic fleet (including small passenger vessels) not subject to the ISM Code was completed in May2002.25 The study noted that other countries, such as Australia, New Zealand, United Kingdom and Denmark, have in place or are developing requirements for safety management-type systems applicable to their small passenger vessels. The application of safety management principles to small vessels was, in general, to address safety shortcomings and to promote a higher level of safety in line with the expectations of the travelling public. Currently, TC is examining the results of the study. Recognizing that the ISM Code may be beyond the scope of most small operators, a system tailored to the needs of operators of small passenger vessels, which incorporates principles of effective safety management, would assist small vessel operators to help ensure that the company, the vessel, and its crew are fit for their intended purpose. Given the benefits associated in preventing accidents, and the need for a structured approach for operators to effectively manage the risks associated with their operation on an ongoing basis, the Board recommends that: The Department of Transport take steps to ensure that small passenger vessel enterprises have a safety management system. M04-01 Assessment/Reassessment Rating: Satisfactory Intent 4.2.2 Adequacy of the Regulatory Framework for Small Passenger Vessels The current regulatory framework does not address all aspects of the operation of small passenger vessels with a gross tonnage of 15or less carrying not more than 12passengers and, as demonstrated in this occurrence, the Canada Shipping Act (CSA), its regulations, standards, and guidelines are complex and their applicability by ship inspectors and owners/operators is not consistent. TC acknowledges the complexity of its regulatory framework. The CSA is to be replaced by the Canada Shipping Act(2001), which received Royal Assent in November2001. It is planned that the Canada Shipping Act(2001) will come into force in2006. In order to give full effect to the Canada Shipping Act (2001), over 100regulations must be reviewed and restructured. Regulation development is proceeding in two phases. Phase1 includes new regulations required to support the Canada Shipping Act(2001), and existing regulations that are inconsistent with this Act need to be overhauled. Phase2 will include those regulations that are consistent with the new Act, but need to be modernized. Regulations that are not in urgent need of reform for safety reasons will also be reviewed and amended in Phase2.26 Within Phase1, there are initiatives underway affecting small passenger vessels. For example, a requirement for a certificated master of commercial passenger vessels with a gross tonnage of less than5, and completion of applicable Marine Emergency Duties (MED) courses before obtaining a Master Limited certificate are being examined as part of the reform of the Crewing Regulations and Marine Certification Regulations. In another initiative, TC has introduced an amendment that will incorporate, by reference, the Construction Standards for Small Vessels (TP1332).New small passenger vessels will have to comply with the standard. Existing small passenger vessels will comply only to the extent that it is reasonable and practical to do so. However, in the Board's view, other safety shortcomings need to be addressed. For instance, even though crew members are currently required to have basic safety training at a recognized institution before completing six months on board a Canadian vessel, it may take two or more operating seasons on board small passenger vessels that operate on a seasonal basis to accumulate the six months. It is not uncommon for seasonal operators to hire new crew at the beginning of a new operating season. The Board is encouraged that cooperation between TC and the Canadian Passenger Vessel Association (CPVA), representing some 50commercial operators, has resulted in the development of a TC-approved in-house training course. However, CPVA membership represents only a small percentage of small passenger vessels in operation. The current regulatory regime for small passenger vessels applies to a wide range of vessels whose risk profiles vary substantially. Further, prescriptive regulations and benchmarks have been established on what could be described as arbitrary criteria, be they length/tonnage restrictions, number of passengers, etc. Such an approach may not fully reflect the risks inherent in an operation. For example, while there is a requirement that the complement of every passenger ship certified to carry more than 12passengers be sufficient in number to direct and control the passengers who are on board in an emergency, there is no such requirement for passenger vessels carrying not more than 12passengers. In the past, there was a tendency for owners/operators of small passenger vessels to rely on annual inspections by TC as the means of ensuring compliance. Subsequent to the increase to the exemption threshold for annual inspection, there has been increased reliance by TC on self-inspection. In fact, regulatory compliance for small passenger vessels with a gross tonnage of 15or less relies on self-inspection by owners/operators who may not be fully conversant with all safety requirements. Until such time as the regulatory framework can be easily understood, the implementation of a self-inspection regime will be problematic and risks to the travelling public will continue. The application of the existing and future regulatory framework is dependent upon an up-to-date registry of vessels in operation. While TC estimates that approximately 10000small passenger vessels with a gross tonnage of 15or less are required to be either licensed or registered, as of December2003, TC reports that there were 736licensed and 375registered small passenger vessels. TC is taking steps to address this discrepancy through the establishment of a Small Vessel Register and expects to have all vessels identified by2011. The Board acknowledges the initiatives by TC to reform the current regulatory framework to make it more streamlined, applicable, and effective. However, given the planned timeframe of2006 for completion of this reform, and the large number of small passenger vessels that have yet to be identified, the Board recommends that: The Department of Transport expedite the development of a regulatory framework that is easily understood and applicable to all small passenger vessels and their operation. M04-02 Assessment/Reassessment Rating: Fully Satisfactory 4.2.3 Passenger Evacuation In an emergency, passengers need time to access and don lifejackets and to identify and reach evacuation points. The time necessary to safely escape from a vessel in distress must be less than the time it takes for the vessel to flood and sink. While large passenger vessels are required to be subdivided to control flooding, small passenger vessels of open construction are not, nor are they required to be inherently buoyant in the event of flooding. As a result, the timely decision and effective evacuation of passengers from small passenger vessels are critical before buoyancy is lost and the vessel sinks. Therefore, safety measures must ensure that the sinking of a vessel is delayed at least as long as it takes to send distress messages and complete the safe evacuation of the vessel. On 01 May 1999, the amphibious passenger vehicle MissMajestic,with an operator and 20passengers on board, entered Lake Hamilton near Hot Springs, Arkansas, United States, on an excursion tour. About seven minutes after entering the water, the vehicle listed to port and rapidly sank by the stern. One passenger escaped before the vehicle submerged but the remaining passengers and the operator were trapped by the vehicle's canopy roof and drawn under water. As the vehicle sank, six passengers and crew were able to escape and, upon their reaching the water's surface, were rescued by pleasure boaters in the area. The remaining 13passengers, including three children, lost their lives. Contributing to the high loss of life was a continuous canopy roof that entrapped passengers within the sinking vehicle. As a result of the occurrence and subsequent investigation, the National Transportation Safety Board (NTSB) recommended that the U.S. Coast Guard: In making these recommendations, the NTSB highlighted the critical relationship between a vessel's reserve buoyancy and its design characteristics that allow for the safe evacuation in the event of emergencies. The passengers and crew of the LadyDuck experienced similar difficulties in abandonment due to the rapidity of the sinking, the trim of the vehicle as it sank, and the overhead canopy that prevented passengers from floating free from the vehicle. Additionally, other design features, such as the narrow aisle between the seats, the inadequate exit door aft, two windows that were zipped closed, and the lack of exit signage on the side windows, contributed to a bottleneck when passengers attempted to evacuate the vessel. As a result, similar to the MissMajesticoccurrence, the LadyDucksank so rapidly that some of the passengers were unable to egress before the vehicle was underwater, and they drowned. Small passenger vessels are rarely of standardized design and, consequently, the arrangements for boarding, accommodating, and disembarking passengers vary greatly, particularly in vessels of novel construction such as the LadyDuck. TC has standards for commercial passenger vehicles, such as buses, trains and aircraft, and, to a lesser extent, for small passenger vessels with a gross tonnage greater than 15or carrying more than 12passengers.27 However, there are no statutory requirements for small passenger vessels, such as the LadyDuck, to be ergonomically designed to afford passengers and crew the best possible opportunity to safely evacuate in the event of an emergency. The Board is aware of proposed amendments to incorporate by reference the Construction Standards for Small Vessels (TP1332). However, review indicates that small commercial vessels in excess of 6m, such as the LadyDuck, are not required to incorporate sufficient inherent buoyancy to prevent sinking, and there are no provisions for the timely and unimpeded evacuation of passengers in the event of an emergency. The Board, therefore, recommends that: The Department of Transport ensure that small passenger vessels incorporate sufficient inherent buoyancy and/or other design features to permit safe, timely and unimpeded evacuation of passengers and crew in the event of an emergency. M04-03 Assessment/Reassessment Rating: Fully Satisfactory 4.2.4 Distress Communications and Coordination of Search and Rescue In emergency situations, crews and passengers rely on prompt alerting of others to provide assistance. VHF marine radios represent a reliable means of issuing distress calls in that designated VHF emergency channels are monitored and calls can be received by other vessels, which may be in a position to provide immediate assistance. This ability to communicate on open channels also permits for effective coordination of Search and Rescue (SAR) activities by SAR authorities. The described safety benefits of VHF use, however, may not be realized when operating within areas where there is no continuous VHF radio monitoring. A vessel issuing a distress call on VHF channel16 must, therefore, rely on local vessels that may or may not be monitoring the frequency. In the Ottawa River, Canadian Coast Guard (CCG) SAR coverage is provided up to the Carillon dam only, located near the interprovincial boundary between Ontario and Quebec. Coincidentally, the western limit of propagation of CCG's VHF coverage area also ends at Carillon. From there to Ottawa along the Ottawa River, some 70miles, local VHF radio monitoring is carried out intermittently by police, CCG auxiliary craft, private and commercial craft, marinas, and sailing clubs in the area. Other services - such as911, cellular telephones, and other radio frequencies (e.g. citizens' band radios) - are used to report distress in the Ottawa River. Nautical publications, such as the Small Craft Guide, Rideau Waterway and Ottawa River, describe VHF communications network and services. However, there is no information within the publications to indicate the lack of VHF monitoring coverage for this section of the Ottawa River to better inform and prepare the mariner for emergencies needing external assistance. In addition to this occurrence, since2000, there have been 10occurrences involving commercial vessels carrying passengers on the Ottawa River reported to the TSB. As a result of an investigation into one of these occurrences, in which a passenger fell overboard,28 the Board issued a safety concern that channel16 VHF radio communications in the Ottawa area still cannot be monitored by MCTS [Marine Communications and Traffic Services] stations, and that local communications and SAR resources are not effectively organized or coordinated by CCG SAR. In a subsequent TSB investigation into an occurrence involving a passenger vessel,29 the investigation revealed a similar safety deficiency. Consequently, the Board reiterated its safety concern stating that: The Board further encouraged the CCG SAR organization to reassess the area plan. In 1999, CCG met with local public protection authorities to discuss boating safety issues, including the absence of radio communication coverage and lack of emergency coordination for the Ottawa River in the NCR. Although the need to address communications and coordination was recognized, no further effective action has been taken to date to address these issues. Proposed amendments to the Ship Station (Radio) Regulations, 1999will require passenger vessels, operating in areas for which no VHF coverage is provided, to have some means of communicating with a responsible party ashore. Most passenger vessels operating in the Ottawa River have such a means at their disposal or in place already - cellular telephones. Although cellular telephones can provide an added measure of safety, they are not a substitute for VHF communications. Even though they can be used to call and inform authorities of an emergency situation, cellular telephones are ineffectual in alerting other vessels, which may be in the best position to provide immediate assistance, nor are they useful for coordinating a rescue activity. Given the number of commercial passenger vessels and pleasure craft operating in the NCR, it is essential that those involved in SAR operations have the means in place to be alerted immediately and to coordinate response operations for an emergency situation. There are a number of authorities and organizations along the Ottawa River that can be called upon to participate in a marine SAR operation. Although there have been some efforts by some of the local police and fire services to equip their marine units with VHF radios, there is no coordinated means in place to ensure that VHF radio distress calls are monitored and that resources can be effectively organized or coordinated. Consequently, responses to emergency situations on the Ottawa River may not be effectively coordinated. The National Search and Rescue Secretariat (NSS), an independent government agency reporting to the Minister of National Defence, has responsibility for promoting the national SAR program. The program is a collection of SAR services provided by all agencies and individuals in Canada, regardless of the type of activity or jurisdiction. Given NSS's leadership role to work directly with federal, provincial and local authorities, and other organizations, to develop and standardize the quality of SAR services, and mitigate risks associated with an improperly coordinated SAR system, the Board recommends that: The National Search and Rescue Secretariat, in collaboration with local authorities and organizations, promote the establishment of a system to monitor distress calls and to effectively coordinate Search and Rescue responses to vessel emergency situations on the Ottawa River between Ottawa and Carillon. M04-04 Assessment/Reassessment Rating: Fully Satisfactory 4.3 Safety Concern 4.3.1 Exchange of Safety-related Information on Amphibious Vehicles In the course of their day-to-day operations, amphibious vehicles, such as the LadyDuck, operate in two distinct environments, and consequently within the regulatory purview of both federal and provincial jurisdictions. In the case of the LadyDuck, TC and the Ministry of Transportation of Ontario (MTO) were responsible for ensuring that the vehicle was suitable for operation in its marine and land-based modes. Any accidents or damage as a result of marine operations are reportable to TC. Consequently, following a marine occurrence, the vehicle will be inspected to ensure that the accident has not affected seaworthiness and passenger safety. However, information concerning accidents occurring during land-based operations, while reportable to the MTO, is not conveyed to TC, nor does TC inform MTO about marine reportable incidents. Damage from such accidents may result in defects that, while not of serious consequence for land-based operations, could affect the vehicle's performance and safety when in the water. When a new operator approaches the MTO to obtain a Commercial Vehicle Operator Registration, the MTO collects information concerning licensing and compliance data, such as accidents, convictions, and inspections, in a commercial vehicle operator database. Information contained in the database allows for the continued evaluation of the safety performance of the company. However, this information is not provided to TC, nor is it required to be. One of the goals of the Small Vessel Monitoring and Inspection Program is to identify vessels which may pose high safety risks.30 Information available from provincial agencies would assist TC in evaluating the safety of amphibious vehicles and assessing the ongoing safety performance of the operator. Consequently, this would facilitate the identification of high-risk vehicles. The Board believes that exchange of information between TC and the MTO is essential to the safety of marine and land operations. The Board is concerned that, without the exchange of information between provincial agencies and TC, unsafe conditions may go undetected, placing passengers and crew at risk.